What is the CVSS score of CVE-2026-47865?

CVE-2026-47865 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Avi Load Balancer are affected by CVE-2026-47865?

VMware Avi Load Balancer versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2 contain a critical authentication bypass (CVSS 9.8) that allows unauthenticated network-adjacent attackers to gain…

How to fix or mitigate CVE-2026-47865?

Within 24 hours: inventory all deployed VMware Avi Load Balancers and identify instances running versions 22.1.1-22.1.7, 30.1.1-30.2.6, or 31.1.1-31.2.2; segment these by criticality and external network exposure. Within 7 days: implement Layer 3 firewall rules restricting access to Avi Controller management ports (22, 443) to only authorized administrator networks and jump hosts; enable detailed audit logging on all controller API calls and authentication attempts; scan historical logs for signs of unauthorized access or exploitation. Within 30 days: monitor VMware/Broadcom security bulletins for a released patch; develop a staged upgrade plan with roll-out windows; if patch timeline extends beyond organizational risk tolerance, evaluate failover to alternative load-balancing platforms or temporary removal of external-facing Avi instances from production.

Avi Load Balancer CVE-2026-47865

EUVD-2026-45360 CRITICAL

Improper Authentication (CWE-287)

2026-07-18 vmware

GHSA-g2gr-xhcw-h7mc

Authentication Bypass VMware Avi Load Balancer

9.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 09:31 vuln.today

CVE Published

Jul 18, 2026 - 08:57 cve.org

CRITICAL 9.8

DescriptionCVE.org

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Articles & Coverage 2

News 7 New VMware Vulnerabilities - 1 Critical, 6 High Severity Jul 19, 2026 News Critical Authentication Bypass in VMware Avi Load Balancer - CVE-2026-47865 Jul 18, 2026

AnalysisAI

Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch.